Hacking Articles Tips Tricks Videos Tutorials

Kerberoast - Kerberoast Attack -Pure Python-
http://www.kitploit.com/2021/12/kerberoast-kerberoast-attack-pure-python.html

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

4 viewsedited 11:30

Hacking Articles Tips Tricks Videos Tutorials

5 views11:30

Hacking Articles Tips Tricks Videos Tutorials

Kerberos attack toolkit -pure python-
Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos (https://www.kitploit.com/search/label/Kerberos) are the following
: +://\:@/?=
: +://\:@/?= Steps -with SSPI-: kerberoast auto Steps -SSPI not used-: Look for vulnerable (https://www.kitploit.com/search/label/Vulnerable) users via LDAP
kerberoast ldap all -o ldapenum Use ASREP roast against users in the ldapenum_asrep_users.txt file
kerberoast asreproast -t ldapenum_asrep_users.txt Use SPN roast against users in the ldapenum_spn_users.txt file
kerberoast spnroast -t ldapenum_spn_users.txt Crack SPN roast and ASPREP roast output with hashcat Commands ldap This command group is for enumerating potentially vulnerable users via LDAP. Command structure     kerberoast ldap Type: It supports three types of users to be enumerated spn Enumerates users with servicePrincipalName attribute set. asrep Enumerates users with DONT_REQ_PREAUTH flag set in their UAC attribute. all Startes all the above mentioned enumerations. ldap_connection_url: Specifies the usercredential and the target server in the msldap url format (see help) options:
    -o: Output file base name brute This command is to perform username (https://www.kitploit.com/search/label/Username) enumeration (https://www.kitploit.com/search/label/Enumeration) by brute-forcing the kerberos service with possible username candidates Command structure     kerberoast brute realm: The kerberos realm usually looks like COMPANY.corp
dc_ip: IP or hostname of the domain controller
targets: Path to the file which contains the possible username candidates
options:
    -o: Output file base name asreproast This command is to perform ASREProast attack Command structure     kerberoast asreproast dc_ip: IP or hostname of the domain controller
options:
    -r: Specifies the kerberos realm to be used. It overrides all other realm info.
    -o: Output file base name
    -t: Path to the file which contains the usernames (https://www.kitploit.com/search/label/Usernames) to perform the attack on
    -u: Specifies the user to perform the attack on. Format is either or @ but in the first case, the -r option must be used to specify the realm spnroast This command is to perform SPNroast (AKA kerberoast) attack. Command structure     kerberoast spnroast kerberos_connection_url: Specifies the usercredential and the target server in the kerberos URL format (see help) options:
    -r: Specifies the kerberos realm to be used. It overrides all other realm info.
    -o: Output file base name
    -t: Path to the file which contains the usernames to perform the attack on
    -u: Specifies the user to perform the attack on. Format is either or @ but in the first case, the -r option must be used to specify the realm

Download Kerberoast (https://github.com/skelsec/kerberoast)

___________________________
@hacking_Attack
@Hacking_Video